Overview
Researchers at Parameter Labs disclosed a sophisticated, multi-stage exploit chain targeting ChatGPT’s HTML preview feature — OpenAI’s sandboxed iframe environment for rendering AI-generated interactive HTML applications (formerly called Canvas). The vulnerability allowed an attacker to craft a shareable ChatGPT URL that, when opened by any signed-in user, would silently exfiltrate their private data or take actions on their behalf. OpenAI has since patched the issue and paid a $5,000 bug bounty.
Technical Analysis
The attack chain exploited several compounding weaknesses:
Unsafe postMessage handler in MathLive: OpenAI’s graph support relies on the MathLive JavaScript library, which includes a virtual keyboard feature. The keyboard can be triggered from within a sandboxed iframe via
postMessage()to the parent page. The parent-side message handler usedinnerHTMLto insert content — a well-known XSS vector.Missing origin validation: There was no mechanism to prevent arbitrary sandboxed frames, including HTML preview iframes, from sending the triggering postMessage. This meant untrusted AI-generated HTML could invoke the MathLive handler.
Sandbox escape via injected iframe: While
innerHTMLdoes not execute<script>tags directly, it can inject<iframe>elements. By injecting an iframe without sandbox restrictions, the attacker gained a less-restricted execution context on the ChatGPT origin.CSP bypass via YouTube oEmbed: OpenAI’s Content Security Policy blocked inline scripts and restricted external script sources to a small allowlist — which included YouTube. The YouTube oEmbed endpoint can be used to reflect attacker-controlled JavaScript in a format that browsers execute, effectively turning a trusted CSP allowlisted domain into a script gadget.
With full JavaScript execution on the ChatGPT origin achieved, exfiltrating private data was trivial: API calls to fetch conversation history, then data exfiltration via an <img> tag pointing to an attacker-controlled server.
Sandboxed iframe → postMessage(MathLive trigger) → innerHTML injection
→ unsandboxed iframe → YouTube oEmbed CSP bypass → JS execution
→ fetch(/api/conversations) → img src exfiltration
Framework Mapping
- AML.T0077 (LLM Response Rendering): The root cause lies in how AI-generated HTML output is rendered with insufficient isolation.
- AML.T0067 (LLM Trusted Output Components Manipulation): The MathLive library — a trusted component — was weaponised as the pivot point for sandbox escape.
- AML.T0057 (LLM Data Leakage): Private conversation data was exfiltrated as the final payload.
- LLM02 (Insecure Output Handling): AI-generated HTML was rendered in a context where sandbox boundaries could be breached.
- LLM06 (Sensitive Information Disclosure): Private user data was exposed to an unauthenticated third party.
- LLM07 (Insecure Plugin Design): The MathLive integration lacked appropriate input validation on its message-handling interface.
Impact Assessment
Any signed-in ChatGPT user who clicked a malicious share link was potentially exposed. The attack was entirely client-side and required no user interaction beyond visiting the URL. The scope included private conversation history and the ability to perform authenticated actions on behalf of victims — effectively full account compromise within the ChatGPT web interface.
Mitigation & Recommendations
- Validate postMessage origins strictly: All
window.addEventListener('message', ...)handlers must verifyevent.originagainst an explicit allowlist before acting. - Avoid innerHTML for message-driven DOM updates: Use
textContentor structured DOM APIs; never deserialise postMessage payloads via innerHTML. - Tighten CSP allowlists: General-purpose reflective or oEmbed endpoints should never appear on script-src allowlists. Use explicit script hashes or nonces instead.
- Enforce sandbox attributes comprehensively: AI-generated iframe content must carry
sandboxattributes that explicitly deny script injection into parent contexts. - Re-evaluate third-party library integrations: Audit all dependencies included in AI platform frontends for message-handling or DOM-mutation capabilities that could be triggered cross-frame.